@useinvio/nfse-sdk 2.2.0 → 3.1.0

package/dist/agent.js

@@ -0,0 +1,235 @@
+/**
+ * Framework-neutral tool definitions for MCP servers and LLM agents.
+ *
+ * Each tool carries a JSON Schema for input and output, MCP-style annotations
+ * and a `run` handler. Adapters (MCP, OpenAI, LangChain, Vercel AI SDK) only
+ * need to map these fields. Certificate and environment are host
+ * configuration passed in `NfseAgentContext`, never tool input, so a model
+ * cannot select production or see key material.
+ */
+import { CertificateValidationError } from './certificateValidation.js';
+import { DEFAULT_AMBIENTE } from './config.js';
+import { buildDpsFromJson } from './dpsJson.js';
+import { DPS_JSON_REQUEST_SCHEMA } from './dpsJsonSchema.js';
+import { EmitirNotaError } from './emissaoNota.js';
+import { DpsFiscalValidationError, validateDpsJsonRequest } from './fiscalValidation.js';
+import { gunzipBase64 } from './gzipB64.js';
+import { checkJsonSchema } from './jsonSchemaCheck.js';
+import { consultarNfse, extrairErros } from './sefinClient.js';
+import { DpsXsdValidationError, validateDpsXmlAgainstXsd } from './xsdValidation.js';
+export { DPS_JSON_REQUEST_SCHEMA } from './dpsJsonSchema.js';
+function fromValidationIssue(issue) {
+    return { ...issue };
+}
+function sefinIssue(erro) {
+    const authorization = erro.Codigo === 'INVALID_AUTHORIZATION_RESPONSE';
+    return {
+        code: erro.Codigo,
+        path: '$',
+        severity: 'error',
+        source: authorization ? 'sdk' : 'sefin',
+        message: erro.Complemento ? `${erro.Descricao} (${erro.Complemento})` : erro.Descricao,
+        ...(authorization ? { suggestion: 'Consulte a nota pela chave ou concilie a DPS antes de reenviar.' } : {}),
+    };
+}
+/**
+ * Converts known SDK errors to `NfseAgentIssue[]`. Returns `undefined` for
+ * anything else (transport, XSD engine, programming errors) so the caller can rethrow.
+ */
+export function toAgentIssues(error) {
+    if (error instanceof DpsFiscalValidationError)
+        return error.issues.map(fromValidationIssue);
+    if (error instanceof DpsXsdValidationError) {
+        return error.details.map((message) => ({ code: 'XSD_INVALID', path: '$', severity: 'error', source: 'xsd', message }));
+    }
+    if (error instanceof CertificateValidationError) {
+        return [{ code: error.code, path: '$', severity: 'error', source: 'certificate', message: error.message }];
+    }
+    if (error instanceof EmitirNotaError) {
+        const issues = error.erros.map(sefinIssue);
+        return issues.length ? issues : [{ code: 'SEFIN_REJECTED', path: '$', severity: 'error', source: 'sefin', message: error.message }];
+    }
+    return undefined;
+}
+function resolveAmbiente(context) {
+    return context?.ambiente ?? DEFAULT_AMBIENTE;
+}
+function stripEmissao(path) {
+    return path.replace(/^emissao\./, '');
+}
+/** Fields the schema does not accept are reported instead of silently ignored by the builder. */
+function unsupportedFieldIssues(request) {
+    return checkJsonSchema(DPS_JSON_REQUEST_SCHEMA, request)
+        .filter(({ keyword }) => keyword === 'additionalProperties')
+        .map(({ path }) => ({
+        code: 'UNSUPPORTED_FIELD',
+        path: stripEmissao(path),
+        severity: 'error',
+        source: 'schema',
+        message: `${path} nao e um campo suportado pelo schema da DPS`,
+        suggestion: 'Remova o campo ou use o nome canonico descrito no schema.',
+    }));
+}
+function environmentIssue(request, ambiente) {
+    const requested = request?.ambiente;
+    if (requested === undefined || requested === ambiente)
+        return [];
+    return [{
+            code: 'AMBIENTE_NOT_ALLOWED',
+            path: 'ambiente',
+            severity: 'error',
+            source: 'environment',
+            message: `O ambiente e definido pelo host (${ambiente}); a requisicao pediu ${String(requested)}.`,
+            suggestion: 'Remova o campo ambiente da requisicao.',
+        }];
+}
+function validateForAgent(input, context) {
+    const ambiente = resolveAmbiente(context);
+    const request = input?.request;
+    const hostIssues = environmentIssue(request, ambiente);
+    const withAmbiente = request && typeof request === 'object' && !Array.isArray(request) ? { ...request, ambiente } : request;
+    const report = validateDpsJsonRequest(withAmbiente);
+    const structural = report.issues.some((issue) => issue.code === 'INVALID_STRUCTURE');
+    const issues = [
+        ...hostIssues,
+        ...(structural ? [] : unsupportedFieldIssues(withAmbiente)),
+        ...report.issues.map(fromValidationIssue),
+    ];
+    return { ambiente, report, issues, warnings: report.warnings.map(fromValidationIssue), request: withAmbiente };
+}
+const { $schema: _draft, ...requestSchema } = DPS_JSON_REQUEST_SCHEMA;
+const { ambiente: _ambiente, ...requestProperties } = requestSchema.properties;
+/** `DPS_JSON_REQUEST_SCHEMA` without `ambiente`, which belongs to the host. */
+export const DPS_AGENT_REQUEST_SCHEMA = { ...requestSchema, properties: requestProperties };
+const DPS_REQUEST_INPUT_SCHEMA = {
+    type: 'object',
+    properties: { request: DPS_AGENT_REQUEST_SCHEMA },
+    required: ['request'],
+    additionalProperties: false,
+};
+const ISSUE_SCHEMA = {
+    type: 'object',
+    properties: {
+        code: { type: 'string', description: 'Codigo estavel do problema, ex.: TOT_TRIB_REQUIRED ou codigo SEFIN.' },
+        path: { type: 'string', description: 'Campo afetado; $ quando global.' },
+        severity: { type: 'string', enum: ['error', 'warning'] },
+        source: { type: 'string', enum: ['sdk', 'invio', 'schema', 'xsd', 'sefin', 'certificate', 'environment'] },
+        message: { type: 'string' },
+        suggestion: { type: 'string' },
+    },
+    required: ['code', 'path', 'severity', 'source', 'message'],
+    additionalProperties: false,
+};
+const ISSUES = { type: 'array', items: ISSUE_SCHEMA };
+const AMBIENTE = { type: 'string', enum: ['restrita', 'producao'] };
+export const validateDpsTool = {
+    name: 'validate_dps',
+    title: 'Validar DPS da NFS-e',
+    description: 'Valida uma requisicao de DPS (NFS-e Nacional) sem certificado, sem rede e sem efeitos colaterais. ' +
+        'Retorna issues com code, path, message e suggestion; corrija os campos indicados e valide novamente ate valid=true. ' +
+        'Nao invente codigos fiscais (cTribNac, regime, tributacao): pergunte ao usuario quando faltarem.',
+    inputSchema: DPS_REQUEST_INPUT_SCHEMA,
+    outputSchema: {
+        type: 'object',
+        properties: { valid: { type: 'boolean' }, schemaVersion: { type: 'string' }, ambiente: AMBIENTE, issues: ISSUES, warnings: ISSUES },
+        required: ['valid', 'schemaVersion', 'ambiente', 'issues', 'warnings'],
+        additionalProperties: false,
+    },
+    annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false },
+    requiresCertificate: false,
+    async run(input, context) {
+        const { ambiente, report, issues, warnings } = validateForAgent(input, context);
+        return { valid: issues.length === 0, schemaVersion: report.schemaVersion, ambiente, issues, warnings };
+    },
+};
+export const buildDpsXmlTool = {
+    name: 'build_dps_xml',
+    title: 'Gerar XML da DPS',
+    description: 'Valida a requisicao e gera o XML nao assinado da DPS, conferido contra o XSD oficial v1.01. ' +
+        'Nao assina nem transmite. Use para revisar a nota antes de pedir a emissao ao usuario.',
+    inputSchema: DPS_REQUEST_INPUT_SCHEMA,
+    outputSchema: {
+        type: 'object',
+        properties: {
+            ok: { type: 'boolean' },
+            ambiente: AMBIENTE,
+            dpsId: { type: 'string', description: 'Id de 45 caracteres da DPS.' },
+            xml: { type: 'string', description: 'XML da DPS nao assinado.' },
+            issues: ISSUES,
+            warnings: ISSUES,
+        },
+        required: ['ok', 'ambiente', 'issues', 'warnings'],
+        additionalProperties: false,
+    },
+    annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false },
+    requiresCertificate: false,
+    async run(input, context) {
+        const { ambiente, issues, warnings, request } = validateForAgent(input, context);
+        if (issues.length)
+            return { ok: false, ambiente, issues, warnings };
+        try {
+            const built = buildDpsFromJson(request);
+            validateDpsXmlAgainstXsd(built.xml);
+            return { ok: true, ambiente, dpsId: built.id, xml: built.xml, issues: [], warnings };
+        }
+        catch (error) {
+            const mapped = toAgentIssues(error);
+            if (!mapped)
+                throw error;
+            return { ok: false, ambiente, issues: mapped, warnings };
+        }
+    },
+};
+export const getNfseTool = {
+    name: 'get_nfse',
+    title: 'Consultar NFS-e',
+    description: 'Consulta uma NFS-e na SEFIN pela chave de acesso de 50 digitos, no ambiente configurado pelo host. ' +
+        'Use tambem para conciliar uma emissao com resposta ambigua antes de qualquer reenvio.',
+    inputSchema: {
+        type: 'object',
+        properties: { chaveAcesso: { type: 'string', pattern: '^\\d{50}$', description: 'Chave de acesso da NFS-e, 50 digitos.' } },
+        required: ['chaveAcesso'],
+        additionalProperties: false,
+    },
+    outputSchema: {
+        type: 'object',
+        properties: {
+            ok: { type: 'boolean' },
+            ambiente: AMBIENTE,
+            chaveAcesso: { type: 'string' },
+            status: { type: 'number', description: 'Status HTTP da SEFIN.' },
+            nfseXml: { type: 'string', description: 'XML da NFS-e quando retornado.' },
+            body: { description: 'Corpo da resposta da SEFIN, sem o XML compactado.' },
+            issues: ISSUES,
+        },
+        required: ['ok', 'ambiente', 'chaveAcesso', 'issues'],
+        additionalProperties: false,
+    },
+    annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: true },
+    requiresCertificate: true,
+    async run(input, context) {
+        const ambiente = resolveAmbiente(context);
+        const chaveAcesso = String(input?.chaveAcesso ?? '');
+        const fail = (issue) => ({ ok: false, ambiente, chaveAcesso, issues: [issue] });
+        if (!/^\d{50}$/.test(chaveAcesso)) {
+            return fail({ code: 'CHAVE_ACESSO_INVALID_FORMAT', path: 'chaveAcesso', severity: 'error', source: 'sdk', message: 'chaveAcesso deve ter 50 digitos numericos.' });
+        }
+        if (!context?.pfx) {
+            return fail({ code: 'CERTIFICATE_REQUIRED', path: '$', severity: 'error', source: 'certificate', message: 'O host nao configurou um certificado A1 para consultar a SEFIN.' });
+        }
+        const { status, body } = await consultarNfse(chaveAcesso, context.pfx, ambiente);
+        const { nfseXmlGZipB64, NfseXmlGZipB64, ...rest } = (body && typeof body === 'object' && !Array.isArray(body) ? body : { value: body });
+        const compressed = nfseXmlGZipB64 ?? NfseXmlGZipB64;
+        if (status < 200 || status >= 300) {
+            const issues = extrairErros(body).map(sefinIssue);
+            return { ok: false, ambiente, chaveAcesso, status, body: rest, issues: issues.length ? issues : [
+                    { code: `HTTP_${status}`, path: '$', severity: 'error', source: 'sefin', message: `A SEFIN respondeu HTTP ${status}.` },
+                ] };
+        }
+        const nfseXml = typeof compressed === 'string' ? gunzipBase64(compressed) : undefined;
+        return { ok: true, ambiente, chaveAcesso, status, ...(nfseXml ? { nfseXml } : {}), body: rest, issues: [] };
+    },
+};
+/** All tools, in the order an agent typically needs them. */
+export const nfseAgentTools = [validateDpsTool, buildDpsXmlTool, getNfseTool];
+//# sourceMappingURL=agent.js.map

package/dist/agent.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent.js","sourceRoot":"","sources":["../agent.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,0BAA0B,EAAE,MAAM,4BAA4B,CAAC;AACxE,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,uBAAuB,EAAmB,MAAM,oBAAoB,CAAC;AAC9E,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,wBAAwB,EAAE,sBAAsB,EAA2B,MAAM,uBAAuB,CAAC;AAClH,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,YAAY,EAAkB,MAAM,kBAAkB,CAAC;AAC/E,OAAO,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAKrF,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAiF7D,SAAS,mBAAmB,CAAC,KAAyB;IACpD,OAAO,EAAE,GAAG,KAAK,EAAE,CAAC;AACtB,CAAC;AAED,SAAS,UAAU,CAAC,IAAe;IACjC,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,KAAK,gCAAgC,CAAC;IACvE,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,MAAM;QACjB,IAAI,EAAE,GAAG;QACT,QAAQ,EAAE,OAAO;QACjB,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO;QACvC,OAAO,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,SAAS,KAAK,IAAI,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS;QACtF,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,iEAAiE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5G,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,IAAI,KAAK,YAAY,wBAAwB;QAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;IAC5F,IAAI,KAAK,YAAY,qBAAqB,EAAE,CAAC;QAC3C,OAAO,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;IACzH,CAAC;IACD,IAAI,KAAK,YAAY,0BAA0B,EAAE,CAAC;QAChD,OAAO,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IAC7G,CAAC;IACD,IAAI,KAAK,YAAY,eAAe,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC3C,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IACtI,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,eAAe,CAAC,OAAqC;IAC5D,OAAO,OAAO,EAAE,QAAQ,IAAI,gBAAgB,CAAC;AAC/C,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,OAAO,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;AACxC,CAAC;AAED,iGAAiG;AACjG,SAAS,sBAAsB,CAAC,OAAgB;IAC9C,OAAO,eAAe,CAAC,uBAAuB,EAAE,OAAO,CAAC;SACrD,MAAM,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,OAAO,KAAK,sBAAsB,CAAC;SAC3D,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QAClB,IAAI,EAAE,mBAAmB;QACzB,IAAI,EAAE,YAAY,CAAC,IAAI,CAAC;QACxB,QAAQ,EAAE,OAAO;QACjB,MAAM,EAAE,QAAQ;QAChB,OAAO,EAAE,GAAG,IAAI,8CAA8C;QAC9D,UAAU,EAAE,2DAA2D;KACxE,CAAC,CAAC,CAAC;AACR,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAgB,EAAE,QAAkB;IAC5D,MAAM,SAAS,GAAI,OAAyC,EAAE,QAAQ,CAAC;IACvE,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IACjE,OAAO,CAAC;YACN,IAAI,EAAE,sBAAsB;YAC5B,IAAI,EAAE,UAAU;YAChB,QAAQ,EAAE,OAAO;YACjB,MAAM,EAAE,aAAa;YACrB,OAAO,EAAE,oCAAoC,QAAQ,yBAAyB,MAAM,CAAC,SAAS,CAAC,GAAG;YAClG,UAAU,EAAE,wCAAwC;SACrD,CAAC,CAAC;AACL,CAAC;AAED,SAAS,gBAAgB,CAAC,KAA0B,EAAE,OAAqC;IACzF,MAAM,QAAQ,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,OAAO,GAAI,KAAkD,EAAE,OAAO,CAAC;IAC7E,MAAM,UAAU,GAAG,gBAAgB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACvD,MAAM,YAAY,GAAG,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;IAC5H,MAAM,MAAM,GAAG,sBAAsB,CAAC,YAAY,CAAC,CAAC;IACpD,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,mBAAmB,CAAC,CAAC;IACrF,MAAM,MAAM,GAAG;QACb,GAAG,UAAU;QACb,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,sBAAsB,CAAC,YAAY,CAAC,CAAC;QAC3D,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAC;KAC1C,CAAC;IACF,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,mBAAmB,CAAC,EAAE,OAAO,EAAE,YAA8B,EAAE,CAAC;AACnI,CAAC;AAED,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,aAAa,EAAE,GAAG,uBAAuB,CAAC;AACtE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,iBAAiB,EAAE,GAAG,aAAa,CAAC,UAAwC,CAAC;AAE7G,+EAA+E;AAC/E,MAAM,CAAC,MAAM,wBAAwB,GAAe,EAAE,GAAG,aAAa,EAAE,UAAU,EAAE,iBAAiB,EAAE,CAAC;AAExG,MAAM,wBAAwB,GAAe;IAC3C,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE,EAAE,OAAO,EAAE,wBAAwB,EAAE;IACjD,QAAQ,EAAE,CAAC,SAAS,CAAC;IACrB,oBAAoB,EAAE,KAAK;CAC5B,CAAC;AAEF,MAAM,YAAY,GAAe;IAC/B,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE;QACV,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,qEAAqE,EAAE;QAC5G,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,iCAAiC,EAAE;QACxE,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE;QACxD,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,aAAa,CAAC,EAAE;QAC1G,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QAC3B,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;KAC/B;IACD,QAAQ,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,CAAC;IAC3D,oBAAoB,EAAE,KAAK;CAC5B,CAAC;AACF,MAAM,MAAM,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;AACtD,MAAM,QAAQ,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,UAAU,EAAE,UAAU,CAAC,EAAE,CAAC;AAEpE,MAAM,CAAC,MAAM,eAAe,GAA8D;IACxF,IAAI,EAAE,cAAc;IACpB,KAAK,EAAE,sBAAsB;IAC7B,WAAW,EACT,oGAAoG;QACpG,sHAAsH;QACtH,kGAAkG;IACpG,WAAW,EAAE,wBAAwB;IACrC,YAAY,EAAE;QACZ,IAAI,EAAE,QAAQ;QACd,UAAU,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE;QACnI,QAAQ,EAAE,CAAC,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,CAAC;QACtE,oBAAoB,EAAE,KAAK;KAC5B;IACD,WAAW,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE;IACvG,mBAAmB,EAAE,KAAK;IAC1B,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO;QACtB,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAChF,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IACzG,CAAC;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAA8D;IACxF,IAAI,EAAE,eAAe;IACrB,KAAK,EAAE,kBAAkB;IACzB,WAAW,EACT,8FAA8F;QAC9F,wFAAwF;IAC1F,WAAW,EAAE,wBAAwB;IACrC,YAAY,EAAE;QACZ,IAAI,EAAE,QAAQ;QACd,UAAU,EAAE;YACV,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;YACvB,QAAQ,EAAE,QAAQ;YAClB,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,6BAA6B,EAAE;YACrE,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,0BAA0B,EAAE;YAChE,MAAM,EAAE,MAAM;YACd,QAAQ,EAAE,MAAM;SACjB;QACD,QAAQ,EAAE,CAAC,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,CAAC;QAClD,oBAAoB,EAAE,KAAK;KAC5B;IACD,WAAW,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE;IACvG,mBAAmB,EAAE,KAAK;IAC1B,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO;QACtB,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACjF,IAAI,MAAM,CAAC,MAAM;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;QACpE,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;YACxC,wBAAwB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACpC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC;QACvF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;YACpC,IAAI,CAAC,MAAM;gBAAE,MAAM,KAAK,CAAC;YACzB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;QAC3D,CAAC;IACH,CAAC;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,WAAW,GAAuD;IAC7E,IAAI,EAAE,UAAU;IAChB,KAAK,EAAE,iBAAiB;IACxB,WAAW,EACT,qGAAqG;QACrG,uFAAuF;IACzF,WAAW,EAAE;QACX,IAAI,EAAE,QAAQ;QACd,UAAU,EAAE,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,uCAAuC,EAAE,EAAE;QAC3H,QAAQ,EAAE,CAAC,aAAa,CAAC;QACzB,oBAAoB,EAAE,KAAK;KAC5B;IACD,YAAY,EAAE;QACZ,IAAI,EAAE,QAAQ;QACd,UAAU,EAAE;YACV,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;YACvB,QAAQ,EAAE,QAAQ;YAClB,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC/B,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,uBAAuB,EAAE;YAChE,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,gCAAgC,EAAE;YAC1E,IAAI,EAAE,EAAE,WAAW,EAAE,mDAAmD,EAAE;YAC1E,MAAM,EAAE,MAAM;SACf;QACD,QAAQ,EAAE,CAAC,IAAI,EAAE,UAAU,EAAE,aAAa,EAAE,QAAQ,CAAC;QACrD,oBAAoB,EAAE,KAAK;KAC5B;IACD,WAAW,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE;IACtG,mBAAmB,EAAE,IAAI;IACzB,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO;QACtB,MAAM,QAAQ,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;QAC1C,MAAM,WAAW,GAAG,MAAM,CAAE,KAA+C,EAAE,WAAW,IAAI,EAAE,CAAC,CAAC;QAChG,MAAM,IAAI,GAAG,CAAC,KAAqB,EAAqB,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACnH,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC,EAAE,IAAI,EAAE,6BAA6B,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,4CAA4C,EAAE,CAAC,CAAC;QACrK,CAAC;QACD,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC;YAClB,OAAO,IAAI,CAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,iEAAiE,EAAE,CAAC,CAAC;QACjL,CAAC;QAED,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,aAAa,CAAC,WAAW,EAAE,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QACjF,MAAM,EAAE,cAAc,EAAE,cAAc,EAAE,GAAG,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAA4B,CAAC;QACnK,MAAM,UAAU,GAAG,cAAc,IAAI,cAAc,CAAC;QACpD,IAAI,MAAM,GAAG,GAAG,IAAI,MAAM,IAAI,GAAG,EAAE,CAAC;YAClC,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YAClD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;oBAC9F,EAAE,IAAI,EAAE,QAAQ,MAAM,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,0BAA0B,MAAM,GAAG,EAAE;iBACxH,EAAE,CAAC;QACN,CAAC;QACD,MAAM,OAAO,GAAG,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACtF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAC9G,CAAC;CACF,CAAC;AAEF,6DAA6D;AAC7D,MAAM,CAAC,MAAM,cAAc,GAA6B,CAAC,eAAe,EAAE,eAAe,EAAE,WAAW,CAAC,CAAC"}

package/dist/certificate.d.ts

@@ -0,0 +1,96 @@
+import { type KeyObject } from 'node:crypto';
+import https from 'node:https';
+import { inspect } from 'node:util';
+import forge from 'node-forge';
+import { type PfxMaterial } from './loadPfx.js';
+/** Public, non-secret facts about an A1 certificate. Safe to log. */
+export interface NfseCertificateInfo {
+    /** Subject common name, e.g. `EMPRESA LTDA:12345678000195`. */
+    subject: string;
+    issuer: string;
+    /** CNPJ from the ICP-Brasil otherName (OID 2.16.76.1.3.3), when present. */
+    cnpj?: string;
+    /** CPF from the ICP-Brasil otherName (OID 2.16.76.1.3.1), when present. */
+    cpf?: string;
+    notBefore: Date;
+    notAfter: Date;
+    serialNumber: string;
+    /** SHA-256 fingerprint, colon-separated hex. Use it to identify the certificate in logs. */
+    fingerprintSha256: string;
+}
+/** Everything the SDK accepts as signing + mTLS material. */
+export type CertificateInput = NfseCertificate | PfxMaterial;
+export interface NfseCertificateFromPemInput {
+    /** Private key in PEM (PKCS#1 or PKCS#8). */
+    key: string | Buffer;
+    /** Holder certificate in PEM. */
+    cert: string | Buffer;
+    /** Passphrase when the PEM key is encrypted. */
+    passphrase?: string;
+}
+/** Environment variable names read by {@link NfseCertificate.fromEnv}. */
+export declare const NFSE_CERT_ENV: {
+    readonly path: "NFSE_CERT_PATH";
+    readonly base64: "NFSE_CERT_BASE64";
+    readonly password: "NFSE_CERT_PASSWORD";
+    readonly passwordFile: "NFSE_CERT_PASSWORD_FILE";
+};
+/** @internal Material the signer and the HTTPS client need. Never exported from the package root. */
+export interface CertificateCredentials {
+    privateKey: KeyObject | string;
+    certPem: string;
+    certDerBase64: string;
+    tls: Pick<https.RequestOptions, 'agent' | 'key' | 'cert'>;
+}
+/**
+ * Reads CNPJ/CPF from the ICP-Brasil subjectAltName otherName fields. Falls
+ * back to the `NOME:DOCUMENTO` suffix of the common name used by ICP-Brasil CAs.
+ */
+export declare function icpBrasilTaxIds(cert: forge.pki.Certificate, commonName?: string): {
+    cnpj?: string;
+    cpf?: string;
+};
+/**
+ * An A1 (ICP-Brasil) certificate loaded for signing and mTLS.
+ *
+ * The private key is kept as a non-exportable-by-accident `KeyObject` and a
+ * dedicated TLS agent, both held outside the object. The PFX bytes and the
+ * password are not retained. `console.log`, `JSON.stringify` and error
+ * serializers only ever see {@link NfseCertificateInfo}.
+ */
+export declare class NfseCertificate implements NfseCertificateInfo {
+    readonly subject: string;
+    readonly issuer: string;
+    readonly cnpj?: string;
+    readonly cpf?: string;
+    readonly notBefore: Date;
+    readonly notAfter: Date;
+    readonly serialNumber: string;
+    readonly fingerprintSha256: string;
+    private constructor();
+    /** Loads a `.pfx`/`.p12` from memory. */
+    static fromPfx(pfx: Buffer | Uint8Array, password: string): NfseCertificate;
+    /** Loads a `.pfx`/`.p12` file from disk. */
+    static fromFile(path: string, password: string): NfseCertificate;
+    /** Loads a base64-encoded PFX (whitespace and `data:` URLs accepted), the usual format for env vars and secret managers. */
+    static fromBase64(content: string, password: string): NfseCertificate;
+    /** Loads a PEM key + certificate pair, e.g. extracted once with `openssl pkcs12 -legacy`. */
+    static fromPem(input: NfseCertificateFromPemInput): NfseCertificate;
+    /**
+     * Loads the certificate from environment variables:
+     * `NFSE_CERT_PATH` or `NFSE_CERT_BASE64`, plus `NFSE_CERT_PASSWORD` or
+     * `NFSE_CERT_PASSWORD_FILE` (Docker/Kubernetes secrets).
+     */
+    static fromEnv(env?: NodeJS.ProcessEnv): NfseCertificate;
+    /** Wraps legacy {@link PfxMaterial}; the SDK keeps a `KeyObject`, not the PEM string. */
+    static fromMaterial(material: PfxMaterial): NfseCertificate;
+    isValidAt(now?: Date): boolean;
+    /** Whole days until expiry (negative once expired). Handy for renewal alerts. */
+    daysUntilExpiry(now?: Date): number;
+    /** Closes pooled mTLS sockets. Optional; idle sockets do not keep the process alive. */
+    destroy(): void;
+    toJSON(): NfseCertificateInfo;
+    [inspect.custom](): string;
+}
+/** @internal Resolves either input shape to signing + TLS material. */
+export declare function resolveCredentials(input: CertificateInput): CertificateCredentials;

package/dist/certificate.js

@@ -0,0 +1,218 @@
+import { createPrivateKey, X509Certificate } from 'node:crypto';
+import { readFileSync } from 'node:fs';
+import https from 'node:https';
+import { createSecureContext } from 'node:tls';
+import { inspect } from 'node:util';
+import forge from 'node-forge';
+import { CertificateValidationError } from './certificateValidation.js';
+import { parsePfx } from './loadPfx.js';
+/** Environment variable names read by {@link NfseCertificate.fromEnv}. */
+export const NFSE_CERT_ENV = {
+    path: 'NFSE_CERT_PATH',
+    base64: 'NFSE_CERT_BASE64',
+    password: 'NFSE_CERT_PASSWORD',
+    passwordFile: 'NFSE_CERT_PASSWORD_FILE',
+};
+const ICP_BRASIL_CNPJ_OID = '2.16.76.1.3.3';
+const ICP_BRASIL_CPF_OID = '2.16.76.1.3.1';
+const secrets = new WeakMap();
+function readInfo(certPem) {
+    const x509 = new X509Certificate(certPem);
+    const forgeCert = forge.pki.certificateFromPem(certPem);
+    const commonName = String(forgeCert.subject.getField('CN')?.value ?? x509.subject);
+    const { cnpj, cpf } = icpBrasilTaxIds(forgeCert, commonName);
+    return {
+        subject: commonName,
+        issuer: String(forgeCert.issuer.getField('CN')?.value ?? x509.issuer),
+        ...(cnpj ? { cnpj } : {}),
+        ...(cpf ? { cpf } : {}),
+        notBefore: new Date(x509.validFrom),
+        notAfter: new Date(x509.validTo),
+        serialNumber: x509.serialNumber,
+        fingerprintSha256: x509.fingerprint256,
+    };
+}
+/**
+ * Reads CNPJ/CPF from the ICP-Brasil subjectAltName otherName fields. Falls
+ * back to the `NOME:DOCUMENTO` suffix of the common name used by ICP-Brasil CAs.
+ */
+export function icpBrasilTaxIds(cert, commonName = String(cert.subject.getField('CN')?.value ?? '')) {
+    const found = {};
+    const extension = cert.getExtension('subjectAltName');
+    if (extension?.value) {
+        try {
+            const generalNames = forge.asn1.fromDer(extension.value).value;
+            for (const name of generalNames) {
+                // otherName is context-specific tag [0]: SEQUENCE { type-id OID, [0] EXPLICIT value }
+                if (name.tagClass !== forge.asn1.Class.CONTEXT_SPECIFIC || name.type !== 0 || !Array.isArray(name.value))
+                    continue;
+                const [oidNode, wrapped] = name.value;
+                if (!oidNode || !wrapped || typeof oidNode.value !== 'string')
+                    continue;
+                const oid = forge.asn1.derToOid(oidNode.value);
+                const inner = Array.isArray(wrapped.value) ? wrapped.value[0] : undefined;
+                const text = typeof inner?.value === 'string' ? inner.value : '';
+                if (oid === ICP_BRASIL_CNPJ_OID && /^\d{14}$/.test(text))
+                    found.cnpj = text;
+                // ICP-Brasil e-CPF layout: birth date (8) + CPF (11) + ...
+                if (oid === ICP_BRASIL_CPF_OID && /^\d{19}/.test(text))
+                    found.cpf = text.slice(8, 19);
+            }
+        }
+        catch {
+            // Non-ICP certificates may carry SANs in other shapes; fall back to the CN.
+        }
+    }
+    if (!found.cnpj && !found.cpf) {
+        const suffix = commonName.match(/(?:^|[:\s])(\d{14}|\d{11})$/)?.[1];
+        if (suffix?.length === 14)
+            found.cnpj = suffix;
+        else if (suffix)
+            found.cpf = suffix;
+    }
+    return found;
+}
+function readPasswordFromEnv(env) {
+    const file = env[NFSE_CERT_ENV.passwordFile]?.trim();
+    if (file)
+        return readFileSync(file, 'utf8').replace(/\r?\n$/, '');
+    const password = env[NFSE_CERT_ENV.password];
+    if (password === undefined) {
+        throw new CertificateValidationError('CERTIFICATE_PASSWORD_MISSING', `Defina ${NFSE_CERT_ENV.password} ou ${NFSE_CERT_ENV.passwordFile} com a senha do certificado A1.`);
+    }
+    return password;
+}
+function decodeBase64(content) {
+    const trimmed = content.trim();
+    const payload = trimmed.startsWith('data:') ? trimmed.slice(trimmed.indexOf(',') + 1) : trimmed;
+    return Buffer.from(payload.replace(/\s/g, ''), 'base64');
+}
+/**
+ * An A1 (ICP-Brasil) certificate loaded for signing and mTLS.
+ *
+ * The private key is kept as a non-exportable-by-accident `KeyObject` and a
+ * dedicated TLS agent, both held outside the object. The PFX bytes and the
+ * password are not retained. `console.log`, `JSON.stringify` and error
+ * serializers only ever see {@link NfseCertificateInfo}.
+ */
+export class NfseCertificate {
+    subject;
+    issuer;
+    cnpj;
+    cpf;
+    notBefore;
+    notAfter;
+    serialNumber;
+    fingerprintSha256;
+    constructor(privateKeyPem, certPem, certDerBase64) {
+        Object.assign(this, readInfo(certPem));
+        const privateKey = createPrivateKey(privateKeyPem);
+        const secureContext = createSecureContext({ key: privateKeyPem, cert: certPem });
+        // One agent per certificate: pooled sockets are never shared between tenants.
+        const agent = new https.Agent({ keepAlive: true, secureContext });
+        secrets.set(this, { privateKey, certPem, certDerBase64, tls: { agent } });
+        Object.freeze(this);
+    }
+    /** Loads a `.pfx`/`.p12` from memory. */
+    static fromPfx(pfx, password) {
+        let material;
+        try {
+            material = parsePfx(Buffer.from(pfx), password);
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            if (/MAC could not be verified|Invalid password|senha incorreta/i.test(message)) {
+                throw new CertificateValidationError('CERTIFICATE_INVALID_PASSWORD', 'Senha do certificado A1 incorreta.');
+            }
+            throw new CertificateValidationError('CERTIFICATE_UNREADABLE', `Nao foi possivel ler o certificado A1 (.pfx): ${message}`);
+        }
+        return new NfseCertificate(material.privateKeyPem, material.certPem, material.certDerBase64);
+    }
+    /** Loads a `.pfx`/`.p12` file from disk. */
+    static fromFile(path, password) {
+        return NfseCertificate.fromPfx(readFileSync(path), password);
+    }
+    /** Loads a base64-encoded PFX (whitespace and `data:` URLs accepted), the usual format for env vars and secret managers. */
+    static fromBase64(content, password) {
+        return NfseCertificate.fromPfx(decodeBase64(content), password);
+    }
+    /** Loads a PEM key + certificate pair, e.g. extracted once with `openssl pkcs12 -legacy`. */
+    static fromPem(input) {
+        let privateKeyPem;
+        let certPem;
+        try {
+            const key = createPrivateKey({ key: input.key, format: 'pem', ...(input.passphrase !== undefined ? { passphrase: input.passphrase } : {}) });
+            privateKeyPem = key.export({ type: 'pkcs8', format: 'pem' }).toString();
+            certPem = new X509Certificate(input.cert).toString();
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            throw new CertificateValidationError('CERTIFICATE_UNREADABLE', `Nao foi possivel ler a chave/certificado PEM: ${message}`);
+        }
+        const certDerBase64 = new X509Certificate(certPem).raw.toString('base64');
+        return new NfseCertificate(privateKeyPem, certPem, certDerBase64);
+    }
+    /**
+     * Loads the certificate from environment variables:
+     * `NFSE_CERT_PATH` or `NFSE_CERT_BASE64`, plus `NFSE_CERT_PASSWORD` or
+     * `NFSE_CERT_PASSWORD_FILE` (Docker/Kubernetes secrets).
+     */
+    static fromEnv(env = process.env) {
+        const path = env[NFSE_CERT_ENV.path]?.trim();
+        const base64 = env[NFSE_CERT_ENV.base64]?.trim();
+        if (!path && !base64) {
+            throw new CertificateValidationError('CERTIFICATE_MISSING', `Defina ${NFSE_CERT_ENV.path} (arquivo .pfx) ou ${NFSE_CERT_ENV.base64} (PFX em base64).`);
+        }
+        const password = readPasswordFromEnv(env);
+        return path ? NfseCertificate.fromFile(path, password) : NfseCertificate.fromBase64(base64, password);
+    }
+    /** Wraps legacy {@link PfxMaterial}; the SDK keeps a `KeyObject`, not the PEM string. */
+    static fromMaterial(material) {
+        return new NfseCertificate(material.privateKeyPem, material.certPem, material.certDerBase64);
+    }
+    isValidAt(now = new Date()) {
+        return now >= this.notBefore && now < this.notAfter;
+    }
+    /** Whole days until expiry (negative once expired). Handy for renewal alerts. */
+    daysUntilExpiry(now = new Date()) {
+        return Math.floor((this.notAfter.getTime() - now.getTime()) / 86_400_000);
+    }
+    /** Closes pooled mTLS sockets. Optional; idle sockets do not keep the process alive. */
+    destroy() {
+        const agent = secrets.get(this)?.tls.agent;
+        if (agent instanceof https.Agent)
+            agent.destroy();
+    }
+    toJSON() {
+        return {
+            subject: this.subject,
+            issuer: this.issuer,
+            ...(this.cnpj ? { cnpj: this.cnpj } : {}),
+            ...(this.cpf ? { cpf: this.cpf } : {}),
+            notBefore: this.notBefore,
+            notAfter: this.notAfter,
+            serialNumber: this.serialNumber,
+            fingerprintSha256: this.fingerprintSha256,
+        };
+    }
+    [inspect.custom]() {
+        const holder = this.cnpj ? `cnpj=${this.cnpj}` : this.cpf ? `cpf=${this.cpf}` : `subject=${JSON.stringify(this.subject)}`;
+        return `NfseCertificate { ${holder}, notAfter=${this.notAfter.toISOString()}, fingerprintSha256=${this.fingerprintSha256} }`;
+    }
+}
+/** @internal Resolves either input shape to signing + TLS material. */
+export function resolveCredentials(input) {
+    if (input instanceof NfseCertificate) {
+        const found = secrets.get(input);
+        if (!found)
+            throw new Error('NfseCertificate sem material de chave.');
+        return found;
+    }
+    return {
+        privateKey: input.privateKeyPem,
+        certPem: input.certPem,
+        certDerBase64: input.certDerBase64,
+        tls: { key: input.privateKeyPem, cert: input.certPem },
+    };
+}
+//# sourceMappingURL=certificate.js.map

package/dist/certificate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"certificate.js","sourceRoot":"","sources":["../certificate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAkB,MAAM,aAAa,CAAC;AAChF,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,KAAK,MAAM,YAAY,CAAC;AAC/B,OAAO,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AAC/C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,KAAK,MAAM,YAAY,CAAC;AAC/B,OAAO,EAAE,0BAA0B,EAAE,MAAM,4BAA4B,CAAC;AACxE,OAAO,EAAE,QAAQ,EAAoB,MAAM,cAAc,CAAC;AA8B1D,0EAA0E;AAC1E,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,IAAI,EAAE,gBAAgB;IACtB,MAAM,EAAE,kBAAkB;IAC1B,QAAQ,EAAE,oBAAoB;IAC9B,YAAY,EAAE,yBAAyB;CAC/B,CAAC;AAUX,MAAM,mBAAmB,GAAG,eAAe,CAAC;AAC5C,MAAM,kBAAkB,GAAG,eAAe,CAAC;AAE3C,MAAM,OAAO,GAAG,IAAI,OAAO,EAA2C,CAAC;AAEvE,SAAS,QAAQ,CAAC,OAAe;IAC/B,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;IACxD,MAAM,UAAU,GAAG,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC;IACnF,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,eAAe,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;IAC7D,OAAO;QACL,OAAO,EAAE,UAAU;QACnB,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC;QACrE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzB,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvB,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;QACnC,QAAQ,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC;QAChC,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,iBAAiB,EAAE,IAAI,CAAC,cAAc;KACvC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,IAA2B,EAAE,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;IACxH,MAAM,KAAK,GAAoC,EAAE,CAAC;IAClD,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,gBAAgB,CAAmC,CAAC;IACxF,IAAI,SAAS,EAAE,KAAK,EAAE,CAAC;QACrB,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,KAA0B,CAAC;YACpF,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;gBAChC,sFAAsF;gBACtF,IAAI,IAAI,CAAC,QAAQ,KAAK,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,gBAAgB,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;oBAAE,SAAS;gBACnH,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,KAA0B,CAAC;gBAC3D,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ;oBAAE,SAAS;gBACxE,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;gBAC/C,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAiC,CAAC,CAAC,CAAC,SAAS,CAAC;gBAC3G,MAAM,IAAI,GAAG,OAAO,KAAK,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjE,IAAI,GAAG,KAAK,mBAAmB,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;oBAAE,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC;gBAC5E,2DAA2D;gBAC3D,IAAI,GAAG,KAAK,kBAAkB,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;oBAAE,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACxF,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,4EAA4E;QAC9E,CAAC;IACH,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,6BAA6B,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACpE,IAAI,MAAM,EAAE,MAAM,KAAK,EAAE;YAAE,KAAK,CAAC,IAAI,GAAG,MAAM,CAAC;aAC1C,IAAI,MAAM;YAAE,KAAK,CAAC,GAAG,GAAG,MAAM,CAAC;IACtC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,mBAAmB,CAAC,GAAsB;IACjD,MAAM,IAAI,GAAG,GAAG,CAAC,aAAa,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,CAAC;IACrD,IAAI,IAAI;QAAE,OAAO,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IAClE,MAAM,QAAQ,GAAG,GAAG,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;IAC7C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,IAAI,0BAA0B,CAClC,8BAA8B,EAC9B,UAAU,aAAa,CAAC,QAAQ,OAAO,aAAa,CAAC,YAAY,iCAAiC,CACnG,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,YAAY,CAAC,OAAe;IACnC,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAC/B,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IAChG,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAC;AAC3D,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,eAAe;IACjB,OAAO,CAAU;IACjB,MAAM,CAAU;IAChB,IAAI,CAAU;IACd,GAAG,CAAU;IACb,SAAS,CAAQ;IACjB,QAAQ,CAAQ;IAChB,YAAY,CAAU;IACtB,iBAAiB,CAAU;IAEpC,YAAoB,aAAqB,EAAE,OAAe,EAAE,aAAqB;QAC/E,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QACvC,MAAM,UAAU,GAAG,gBAAgB,CAAC,aAAa,CAAC,CAAC;QACnD,MAAM,aAAa,GAAG,mBAAmB,CAAC,EAAE,GAAG,EAAE,aAAa,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QACjF,8EAA8E;QAC9E,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC;QAClE,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QAC1E,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACtB,CAAC;IAED,yCAAyC;IACzC,MAAM,CAAC,OAAO,CAAC,GAAwB,EAAE,QAAgB;QACvD,IAAI,QAAwC,CAAC;QAC7C,IAAI,CAAC;YACH,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,CAAC;QAClD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvE,IAAI,6DAA6D,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBAChF,MAAM,IAAI,0BAA0B,CAAC,8BAA8B,EAAE,oCAAoC,CAAC,CAAC;YAC7G,CAAC;YACD,MAAM,IAAI,0BAA0B,CAAC,wBAAwB,EAAE,iDAAiD,OAAO,EAAE,CAAC,CAAC;QAC7H,CAAC;QACD,OAAO,IAAI,eAAe,CAAC,QAAQ,CAAC,aAAa,EAAE,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,aAAa,CAAC,CAAC;IAC/F,CAAC;IAED,4CAA4C;IAC5C,MAAM,CAAC,QAAQ,CAAC,IAAY,EAAE,QAAgB;QAC5C,OAAO,eAAe,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,CAAC;IAC/D,CAAC;IAED,4HAA4H;IAC5H,MAAM,CAAC,UAAU,CAAC,OAAe,EAAE,QAAgB;QACjD,OAAO,eAAe,CAAC,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,CAAC;IAClE,CAAC;IAED,6FAA6F;IAC7F,MAAM,CAAC,OAAO,CAAC,KAAkC;QAC/C,IAAI,aAAqB,CAAC;QAC1B,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,gBAAgB,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YAC7I,aAAa,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;YACxE,OAAO,GAAG,IAAI,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;QACvD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvE,MAAM,IAAI,0BAA0B,CAAC,wBAAwB,EAAE,iDAAiD,OAAO,EAAE,CAAC,CAAC;QAC7H,CAAC;QACD,MAAM,aAAa,GAAG,IAAI,eAAe,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC1E,OAAO,IAAI,eAAe,CAAC,aAAa,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC;IACpE,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,OAAO,CAAC,MAAyB,OAAO,CAAC,GAAG;QACjD,MAAM,IAAI,GAAG,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC;QAC7C,MAAM,MAAM,GAAG,GAAG,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC;QACjD,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACrB,MAAM,IAAI,0BAA0B,CAClC,qBAAqB,EACrB,UAAU,aAAa,CAAC,IAAI,sBAAsB,aAAa,CAAC,MAAM,mBAAmB,CAC1F,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;QAC1C,OAAO,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,UAAU,CAAC,MAAO,EAAE,QAAQ,CAAC,CAAC;IACzG,CAAC;IAED,yFAAyF;IACzF,MAAM,CAAC,YAAY,CAAC,QAAqB;QACvC,OAAO,IAAI,eAAe,CAAC,QAAQ,CAAC,aAAa,EAAE,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,aAAa,CAAC,CAAC;IAC/F,CAAC;IAED,SAAS,CAAC,GAAG,GAAG,IAAI,IAAI,EAAE;QACxB,OAAO,GAAG,IAAI,IAAI,CAAC,SAAS,IAAI,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC;IACtD,CAAC;IAED,iFAAiF;IACjF,eAAe,CAAC,GAAG,GAAG,IAAI,IAAI,EAAE;QAC9B,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,GAAG,UAAU,CAAC,CAAC;IAC5E,CAAC;IAED,wFAAwF;IACxF,OAAO;QACL,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC;QAC3C,IAAI,KAAK,YAAY,KAAK,CAAC,KAAK;YAAE,KAAK,CAAC,OAAO,EAAE,CAAC;IACpD,CAAC;IAED,MAAM;QACJ,OAAO;YACL,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtC,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;SAC1C,CAAC;IACJ,CAAC;IAED,CAAC,OAAO,CAAC,MAAM,CAAC;QACd,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,WAAW,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1H,OAAO,qBAAqB,MAAM,cAAc,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,uBAAuB,IAAI,CAAC,iBAAiB,IAAI,CAAC;IAC/H,CAAC;CACF;AAED,uEAAuE;AACvE,MAAM,UAAU,kBAAkB,CAAC,KAAuB;IACxD,IAAI,KAAK,YAAY,eAAe,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACjC,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QACtE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO;QACL,UAAU,EAAE,KAAK,CAAC,aAAa;QAC/B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,GAAG,EAAE,EAAE,GAAG,EAAE,KAAK,CAAC,aAAa,EAAE,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE;KACvD,CAAC;AACJ,CAAC"}

package/dist/certificateValidation.d.ts

@@ -1,7 +1,14 @@
-import type { PfxMaterial } from './loadPfx.js';
+import { type CertificateInput } from './certificate.js';
+export type CertificateValidationCode = 'CERTIFICATE_NOT_YET_VALID' | 'CERTIFICATE_EXPIRED' | 'CERTIFICATE_HOLDER_MISMATCH' | 'CERTIFICATE_INVALID_PASSWORD' | 'CERTIFICATE_UNREADABLE' | 'CERTIFICATE_MISSING' | 'CERTIFICATE_PASSWORD_MISSING';
 export declare class CertificateValidationError extends Error {
-    readonly code: 'CERTIFICATE_NOT_YET_VALID' | 'CERTIFICATE_EXPIRED' | 'CERTIFICATE_HOLDER_MISMATCH';
-    constructor(code: 'CERTIFICATE_NOT_YET_VALID' | 'CERTIFICATE_EXPIRED' | 'CERTIFICATE_HOLDER_MISMATCH', message: string);
+    readonly code: CertificateValidationCode;
+    constructor(code: CertificateValidationCode, message: string);
 }
-/** Final certificate validity and holder check performed immediately before transmission. */
-export declare function assertCertificateForProvider(pfx: PfxMaterial, providerTaxId: string, now?: Date): void;
+/** Validity is checked at signing time and again immediately before transmission. */
+export declare function assertCertificateValidity(certificate: CertificateInput, now?: Date): void;
+/**
+ * Explicit holder check against the ICP-Brasil CNPJ/CPF fields of the
+ * certificate (otherName OIDs 2.16.76.1.3.3 / 2.16.76.1.3.1, or the
+ * `NOME:DOCUMENTO` common name). Does not resolve fiscal representation.
+ */
+export declare function assertCertificateForProvider(certificate: CertificateInput, providerTaxId: string, now?: Date): void;